networks:
  traefik:
    external: true

services:
  unifi-controller:
    container_name: unifi-controller
    image: lscr.io/linuxserver/unifi-controller:latest
    restart: unless-stopped
    networks:
      - traefik
    ports:
      - 8443:8443 # WebUI
      - 3478:3478/udp # STUN
      - 10001:10001/udp # AP discovery
      - 8080:8080 # Device communication
    environment:
      - "PUID={{ service_user.uid }}"
      - "PGID={{ service_user.uid }}"
      - "TZ={{ timezone }}"
    volumes:
      - "{{ data_dir }}/{{ role_name }}:/config"
    labels:
      traefik.enable: true
      traefik.http.routers.unifi.rule: "Host(`unifi.local.{{ personal_domain }}`)"
      traefik.http.routers.unifi.middlewares: lan-whitelist@file
      traefik.http.services.unifi.loadbalancer.server.scheme: https
      traefik.http.services.unifi.loadbalancer.server.port: 8443